An Apology to my European IT Team
fredlybrand.com
An Apology to my European IT Team
1–10 of 97 posts
Re: An Apology to my European IT Team
#2Seems odd that someone wouldn't have understood that even 10-15 years ago. Outsourced means being exposed to risk from your supplier -- by the company itself, by its employees, or by governments. Gmail has somewhat better technical security to protect from outside non-state hackers than your average self-hosted exchange server, and from insiders (the IT guy, like Snowden, may not have the same goals as the organization...), but that may or may not make up for the ease of serving a third-party communications service provider.
I still prefer well-run self-hosted mail unless:
* You have a * You don't have the technical competence to run your own mail server (which gets complicated in a larger organization due to HR risk), or don't have the business competence to hire a contractor to run it in-house in such a way that their staff don't become a huge risk.
There's a third way which would be a lot better for everyone, but it's not technically feasible yet -- a way to outsource some aspects of the server without giving up control.
Re: An Apology to my European IT Team
#3Seems odd that someone wouldn't have understood that even 10-15 years ago. Outsourced means being exposed to risk from your supplier -- by the company itself, by its employees, or by governments. Gmail has somewhat better technical security to protect from outside non-state hackers than your average self-hosted exchange server, and from insiders (the IT guy, like Snowden, may not have the same goals as the organizati…
It would be great to have a service that could manage your mailserver configuration, tracking reputation & avoiding spam, while not having any access at all to the data itself.
Re: An Apology to my European IT Team
#4Seems odd that someone wouldn't have understood that even 10-15 years ago. Outsourced means being exposed to risk from your supplier -- by the company itself, by its employees, or by governments. Gmail has somewhat better technical security to protect from outside non-state hackers than your average self-hosted exchange server, and from insiders (the IT guy, like Snowden, may not have the same goals as the organizati…
It would be great to have a service that could manage your mailserver configuration, tracking reputation & avoiding spam, while not having any access at all to the data itself.
Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
Re: An Apology to my European IT Team
#5Earlier quoted context omitted.
It would be great to have a service that could manage your mailserver configuration, tracking reputation & avoiding spam, while not having any access at all to the data itself.
Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
Maybe homomorphic encryption[0] could help here? Here's what comes up after a quick Google: http://www.eweek.com/c/a/Security/IBM-Uncovers-Encryption-Sc...
Re: An Apology to my European IT Team
#6Earlier quoted context omitted.
It would be great to have a service that could manage your mailserver configuration, tracking reputation & avoiding spam, while not having any access at all to the data itself.
Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
If all your actual email is encrypted then by definition spam is the unencrypted stuff. A long time ago in a different galaxy I built a PGP MTA (based on sendmail at the time) which only forwarded mail that was encrypted, and as expected it was spam free, all though these days spammers just might go to the trouble of sending it encrypted if they thought it would get through.
Re: An Apology to my European IT Team
#7Seems odd that someone wouldn't have understood that even 10-15 years ago. Outsourced means being exposed to risk from your supplier -- by the company itself, by its employees, or by governments. Gmail has somewhat better technical security to protect from outside non-state hackers than your average self-hosted exchange server, and from insiders (the IT guy, like Snowden, may not have the same goals as the organizati…
It would be great to have a service that could manage your mailserver configuration, tracking reputation & avoiding spam, while not having any access at all to the data itself.
Yeah, that wouldn't be too hard to set up. You could run arbitrary services that way -- the key would be keeping configurations totally locked down, so all config edits happen through some kind of defined interface, to let the service provider do full testing. But I don't think individual mailboxes would be very likely to cause changed in testing before deploying upgrades.
You could just use the "virtual appliance" model and do virtual machine level upgrades, with data on a separate partition -- less of a hassle than testing a bunch of upgrades from smaller patches (the paranoia about breaking it is that the service provider doesn't have root, so a failed upgrade could be bad). I'd probably want encrypted backups held with the provider too, for most non sophisticated users.
Re: An Apology to my European IT Team
#8Earlier quoted context omitted.
It would be great to have a service that could manage your mailserver configuration, tracking reputation & avoiding spam, while not having any access at all to the data itself.
Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
It could be a crowd-sourced effort -- e-mails that are spam you mark as spam and upload to some repo that is maintained by someone (a la Adblock). You keep your filters updated, and run your e-mail against the filters file.
Re: An Apology to my European IT Team
#9Earlier quoted context omitted.
It would be great to have a service that could manage your mailserver configuration, tracking reputation & avoiding spam, while not having any access at all to the data itself.
Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
No need to go that far. The provider just pushes code to a server the user controls. The code is trusted to just do mail server with no backdoor for the service provider to get data. That code executes in an environment trusted by the data owner, so the code is allowed to see the data and process based on it.
I'm kind of tempted to do this, since we largely do this kind of thing for VPN already. Doing it with trusted execution lets the code execute on hardware owned by the service provider, but that is technically difficult and hard to prove. Just letting you run code on your own virtual machine host is a lot easier (could be a third party virtualization provider if that is what you want, but I'd at least go for colo of my own server, if not on premise.)
Re: An Apology to my European IT Team
#10Earlier quoted context omitted.
Is there any way to tell if a particular email is spam, without knowing the content or the sender of said email?
No need to go that far. The provider just pushes code to a server the user controls. The code is trusted to just do mail server with no backdoor for the service provider to get data. That code executes in an environment trusted by the data owner, so the code is allowed to see the data and process based on it. I'm kind of tempted to do this, since we largely do this kind of thing for VPN already. Doing it with trusted…
> I'm kind of tempted to do this, since we largely do this kind off thing for VPN already.
Take advantage of the zeitgeist rdl.
You can look forward to at least one customer if you decide to go ahead with this. (me). :)